GHSA-c8w9-83vg-r8vv
OpenStack Glance is vulnerable to Exposure of Sensitive Information
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2013-1840
- https://github.com/openstack/glance/commit/74b067df9726f9cf3e6e17e248719794a6ee0745
- https://github.com/openstack/glance/commit/dd849a9be540bedd4fd904cc0b86ccd9c3e34af2
- https://github.com/openstack/glance/commit/e75764eee34915f8bc5b664ac18e47a556c9d3dd
- https://bugs.launchpad.net/glance/+bug/1135541
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82878
- https://github.com/openstack/glance
- https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2013-46.yaml
- https://review.openstack.org/#/c/24437
- https://review.openstack.org/#/c/24438
- https://review.openstack.org/#/c/24439
- http://osvdb.org/91304
- http://rhn.redhat.com/errata/RHSA-2013-0707.html
- http://secunia.com/advisories/52565
- http://www.openwall.com/lists/oss-security/2013/03/14/15
- http://www.securityfocus.com/bid/58490
- http://www.ubuntu.com/usn/USN-1764-1